rcf-lite 0.16.0 → 0.18.0

package/src/verify/engine/index.js

@@ -18,7 +18,7 @@ import {
 import { readChain as defaultReadChain } from '../chain/index.js';
 import { runProvisioning, cleanup as defaultCleanup } from '../provision/index.js';
 import { composeBrief } from './brief.js';
-import { resolveLauncher } from './launcher.js';
+import { PLAYWRIGHT_MCP_VERSION, playwrightMcpConfig, resolveLauncher } from './launcher.js';
 import { aggregateVerdict, derivePerAcVerdicts, validateFinding } from '../verdict/index.js';
 import { buildReport } from '../report/index.js';
 
@@ -127,11 +127,23 @@ export async function runVerification(opts = {}, deps = {}) {
     if (cleanupResult.cleanupBlocked?.length) provisioning.cleanupBlocked = cleanupResult.cleanupBlocked;
   };
 
+  // Playwright MCP effective pin (spec 2026-09-03, section 1). The override
+  // overrides the constant for one run; unset means the pinned default. The
+  // effective pin lands on the report as runStats.playwrightMcpVersion so a
+  // report re-render tells the operator what browser tooling the pass ran
+  // against, whether default or overridden (spec Q1).
+  const playwrightMcpVersion = opts.playwrightMcpVersion ?? PLAYWRIGHT_MCP_VERSION;
+  const playwrightMcpOverridden = opts.playwrightMcpVersion !== undefined
+    && opts.playwrightMcpVersion !== null;
+  const mcpConfigForPin = playwrightMcpOverridden
+    ? playwrightMcpConfig(playwrightMcpVersion)
+    : undefined;
+
   // 6. Launch the isolated verifier agent (§7.3 isolation env, §9 fresh session).
   let launchResult;
   try {
     const launchAgent = await resolveLauncher(deps);
-    launchResult = await launchAgent({ brief, url, profile });
+    launchResult = await launchAgent({ brief, url, profile, mcpConfig: mcpConfigForPin });
   } catch (err) {
     // A verifier agent that could not run — or whose output could not be
     // ingested — is NEVER a fabricated PASS (§9). But the report is still
@@ -147,6 +159,7 @@ export async function runVerification(opts = {}, deps = {}) {
       findings: [], blockedAcs, provisioning,
       launchFailure: { message: err.message, rawOutputPath: err.rawOutputPath ?? null },
       perAcVerdicts,
+      runStats: { playwrightMcpVersion },
     });
     return { report };
   }
@@ -162,14 +175,21 @@ export async function runVerification(opts = {}, deps = {}) {
   // 9. Aggregate the verdict — split, never averaged (§5.1).
   const verdict = aggregateVerdict({ findings, blockedAcs, notDeployed: false });
 
-  // 10. Build the ingestible report (§5.3).
+  // 10. Build the ingestible report (§5.3). The effective Playwright MCP pin
+  // (default or overridden) always lands on the report as
+  // runStats.playwrightMcpVersion so a report re-render tells the operator
+  // which browser tooling this pass ran against (spec 2026-09-03, Q1).
+  const runStatsForReport = {
+    ...(launchResult?.runStats ?? {}),
+    playwrightMcpVersion,
+  };
   const report = buildReport({
     profile, url, parityEnv, reachability, chainRef: chain.chainRef, repo: opts.repo,
     persona: opts.persona, startedAt, finishedAt: now(),
     verifierIsolation: isolationProvenance(),
     verdict, verdictAuthority,
     findings, blockedAcs, provisioning,
-    runStats: launchResult?.runStats ?? null,
+    runStats: runStatsForReport,
     perAcVerdicts,
   });
 

package/src/verify/engine/launcher.js

@@ -17,6 +17,46 @@ import { isolationEnv, isolationProvenance } from '#core/isolation';
 /** Env var naming a module (exporting `launchAgent`) to use instead of the default spawn launcher. The integration + manual-e2e seam. */
 export const LAUNCHER_ENV = 'RCF_VERIFY_LAUNCHER';
 
+/**
+ * The pinned Playwright MCP version verify runs against. Verify is the ship
+ * gate; @latest re-resolves per verify run and any newly published
+ * Playwright MCP behaviour would become a silent runtime change on the next
+ * pass. The pin closes that reproducibility hole (spec 2026-09-03, section
+ * 1). A bump is a deliberate rcf-lite change with its own commit, CHANGELOG
+ * entry, and, where behaviour is affected, a re-run of the verify test set;
+ * pre-1.0, a Playwright MCP major bump ships as a rcf-lite minor bump per
+ * the pre-1.0 minor-is-breaking convention, a patch bump otherwise.
+ * `rcf verify run --playwright-mcp-version <semver>` overrides for one run
+ * only (emergency use), printed on stderr and recorded on the report.
+ */
+export const PLAYWRIGHT_MCP_VERSION = '0.0.80';
+
+/** True iff the value is a semver X.Y.Z (numeric segments; no pre-release). Verify's override
+ * accepts only exact semver so a typo cannot silently install a range. */
+export function isSemverString(value) {
+  return typeof value === 'string' && /^\d+\.\d+\.\d+$/.test(value);
+}
+
+/**
+ * Compose the Playwright MCP config with the given pin. Exported so the CLI
+ * override can build the same shape without duplicating the DEFAULT_MCP_CONFIG
+ * literal.
+ * @param {string} version - the semver pin
+ * @returns {object}
+ */
+export function playwrightMcpConfig(version) {
+  return {
+    mcpServers: {
+      playwright: {
+        type: 'stdio',
+        command: 'npx',
+        args: ['-y', `@playwright/mcp@${version}`],
+        env: {},
+      },
+    },
+  };
+}
+
 /**
  * The minimal, SCOPED tool surface the verifier agent needs to drive a live
  * app and collect runtime evidence (spec §9 method). Deliberately narrow —
@@ -40,16 +80,7 @@ export const DEFAULT_ALLOWED_TOOLS = Object.freeze([
  * context (§9). Server name `playwright` -> tool prefix `mcp__playwright__*`.
  * `npx` is resolved off PATH for portability (no machine-specific absolute).
  */
-export const DEFAULT_MCP_CONFIG = Object.freeze({
-  mcpServers: {
-    playwright: {
-      type: 'stdio',
-      command: 'npx',
-      args: ['-y', '@playwright/mcp@latest'],
-      env: {},
-    },
-  },
-});
+export const DEFAULT_MCP_CONFIG = Object.freeze(playwrightMcpConfig(PLAYWRIGHT_MCP_VERSION));
 
 /**
  * Build the child-process launch configuration for the verifier agent. Pure